CVE-2026-13131: GeoWebPlayer Array Index Out-of-Bounds Vulnerability

Technical summary

GeoWebPlayer implements a WebSocket server that processes commands containing an `index` parameter used to access arrays controlling critical operations and function calls. The plugin fails to validate whether supplied index values fall within the legitimate range of the targeted array, enabling out-of-bounds memory access. This array indexing vulnerability (CWE-129) can be triggered through multiple commands; the `connectInfo` command is explicitly identified as one attack vector. The vulnerability requires network access to localhost and user interaction to exploit, but once triggered, it permits reading or modifying arbitrary memory accessible to the plugin process.

Business impact

Organizations running GeoVision surveillance systems, video management platforms, or cloud-based video solutions relying on GeoWebPlayer could face unauthorized access to recorded video data, system configuration tampering, or denial of service affecting security camera operations. In surveillance-critical environments (banks, airports, data centers, government facilities), disruption or compromise of video management infrastructure undermines physical security monitoring. Data theft from the system could expose sensitive recorded footage. The attack requires local network access, limiting but not eliminating risk in environments where insider threats or compromised internal systems are concerns.

Affected systems

GeoWebPlayer addon installed with GeoVision software products including GV-VMS, GV-Cloud, and related derivatives. The plugin is optional but may be required for web interface functionality in some deployments. The exact affected version range is not specified in available advisories; verify with GeoVision vendor documentation for your deployed version and configuration.

Exploitability

Exploitation requires network connectivity to the WebSocket server (typically on localhost), lowering the attack surface compared to internet-facing vulnerabilities. However, an attacker with initial access to the local network, a compromised application on the same host, or legitimate but malicious user access could exploit this flaw. The CVSS 3.1 score of 8.3 (HIGH) reflects the combination of high confidentiality and integrity impact, though the complexity and user interaction requirements moderate the overall risk. No known public exploits or weaponized proof-of-concept code has been broadly disclosed.

Remediation

Apply security updates from GeoVision for affected GeoWebPlayer versions. Patch availability and version numbers should be confirmed through the official GeoVision security advisory or support portal. Until patches are deployed, restrict network access to GeoWebPlayer's WebSocket port to trusted systems only, and disable the plugin if not essential to operations. Monitor local network activity and system logs for unusual WebSocket connections or commands.

Patch guidance

Contact GeoVision support or check their security advisory portal for patch availability specific to your GV-VMS, GV-Cloud, or related product version. Apply patches during maintenance windows to avoid disrupting surveillance operations. After patching, verify that web interfaces and plugin functionality restore correctly. Document the patched version for compliance tracking.

Detection guidance

Monitor WebSocket traffic to GeoWebPlayer for suspicious `connectInfo` commands or other commands with unusual index values (extremely large numbers or negative values). Review application logs for memory access errors, segmentation faults, or crash events correlated with WebSocket activity. Implement host-based intrusion detection rules to flag local processes sending multiple malformed commands to the WebSocket server. In network forensics, examine pcap files for WebSocket frames with out-of-range parameters.

Why prioritize this

This vulnerability merits prompt attention in environments where GeoWebPlayer is deployed, particularly in security-sensitive surveillance infrastructure. The HIGH CVSS score, combined with the potential for data theft and system compromise, justifies elevated priority. However, the requirement for local network access and user interaction means it should be ranked below internet-facing remote code execution flaws affecting the same systems. Prioritize patching if GeoWebPlayer is internet-accessible through port forwarding or if insider threat risk is elevated.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects high confidentiality, integrity, and availability impacts (C:H, I:H, A:H) tempered by network access limited to localhost (AV:N with AC:H for practical exploitation), no privileges required (PR:N), and user interaction needed (UI:R). The scope change (S:C) acknowledges that compromising the plugin can affect dependent services and recorded data beyond the plugin itself. The score properly conveys the serious nature of the vulnerability while accounting for the reduced attack surface due to local network constraints.

Frequently asked questions